0

I was learning about XSS and found a website that takes my input say PAYLOAD and converts it to <a href = "example.com/search/PAYLOAD" > Link </a>

After hit and trial, I found that it HTML encodes ", ', < and > . Is there a way for me to implement alert(1) here?

Improve this question

1 Answer 1

Reset to default
1

Edit: Just saw that " is forbidden. Sorry. I still leave the answer as it might be useful for some people.

Of course. There are numerous ways to do this.

One example would be using " onload="alert(1) as the payload.

This will result in <a href = "example.com/search/" onload="alert(1)" > Link </a> which is valid HTML.

Improve this answer
1
  • Is there a way to do it without using the forbidden symbols?
    – Aditya Pratap Singh
    Commented Jun 10, 2020 at 8:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .